A passkey is a cryptographic key pair created for one website. The private key stays on your device or in your passkey provider, and the site only stores the public key. Because the credential is scoped to that site, a look-alike phishing page cannot get a usable sign-in from it.
What happens at registration and sign-in
When you create a passkey, your device generates a key pair for that site. The site keeps the public key. To sign in, the site sends a challenge, your device signs it after you unlock with a biometric, PIN or pattern, and the site checks the signature with the public key.
FIDO describes passkeys as built on FIDO2, meaning WebAuthn and CTAP. The user approves with the same method they use to unlock the device, and no shared secret travels over the network.
Why a fake site gets nothing
The WebAuthn specification says a public key credential is scoped to a Relying Party and can only be accessed by origins belonging to that Relying Party. The browser and the authenticator enforce this together. If you land on a domain that is not the real one, your passkey is simply not offered.
Compare that with a password or a typed one time code. You can be tricked into typing either one into the wrong page. NIST states that manual entry of an authenticator output is not considered phishing resistant.
There is also nothing to steal from the server. A leaked database of public keys does not let anyone sign in.
Synced and device-bound passkeys
Passkeys come in two flavours. A synced passkey is backed up through the provider your devices share, and FIDO says that syncing is end to end encrypted. A device-bound passkey never leaves one device, such as a hardware security key.
The WebAuthn text calls these multi-device and single-device credentials, and whether a credential is eligible for backup is fixed when it is created. NIST also says syncable authenticators cannot be used at its highest assurance level, AAL3, because that level needs a non-exportable key. Most consumer and workforce sign-in does not need AAL3.
Cross-device sign-in
If your passkey is on your phone and you are at a laptop, you can often sign in by scanning a QR code. FIDO says this uses Bluetooth Low Energy to confirm the devices are near each other, and that the transport adds its own cryptographic protection. The Bluetooth link is not what secures the sign-in.
What passkeys do not fix
- A stolen, already logged in session is still a stolen session. See our post on session timeouts and logout.
- Account recovery can undercut everything if it falls back to something weak. Read passkey account recovery design.
- A site that offers a passkey next to an SMS fallback is only as strong as the fallback.
A practical note for teams planning a rollout: test the sign-in on the browsers and operating systems your staff actually use, and write down which passkey providers you support. Users on shared or kiosk machines may need a hardware key instead. Keep a plain support page that explains what a passkey is in two sentences, because most help desk tickets come from confusion about where the passkey lives, not from a security fault.
Quick check
Can a phishing site capture my passkey?
Not in the way it can capture a password. The credential is bound to the real site, so the browser does not offer it to a different origin.
Is a passkey the same as a password manager entry?
No. A password is a shared secret you type. A passkey is a key pair where the private half is never sent to the site.
Sources
Last reviewed: 19 October 2026.
